CVE-2026-34908: critical vulnerability in Ubiquiti Inc EFG
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
An attacker on the network can bypass security controls in UniFi OS devices to make unauthorized changes to the system. This is a critical flaw because it allows complete compromise of the device without requiring special credentials.
CWE-284 (Improper Access Control) in UniFi OS allows network-adjacent attackers to modify system configurations without proper authorization checks. The vulnerability requires network access but no authentication, enabling arbitrary system modifications with full impact on confidentiality, integrity, and availability.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.